Description:
------------
Displaying error messages (filename) is vulnerable to XSS, We just need to set the name of a PHP file to something like this: <img src=x
onerror=alert('XSS')>.php

Test script:
---------------
<img src=x onerror=alert('XSS')>.php:

<?php

$file = $_GET['f'];
$f = fopen($file, 'r');

?>


Expected result:
----------------
When you open this file in your browser you will get 2 XSS popups.